Security::login()ExpressionCacheWarmer as finalenable_authenticator_manager config optionsecurity.firewalls.logout.csrf_token_generator config option, use security.firewalls.logout.csrf_token_manager insteadrequire_previous_session config option from authenticatorsSecurity::ACCESS_DENIED_ERROR, AUTHENTICATION_ERROR and LAST_USERNAME constants, use the ones on SecurityRequestAttributes insteadpattern in firewall configuration$badges argument to Security::loginrequire_previous_session config option. Setting it has no effect anymoreLogoutRouteLoader_stateless attribute to the request when firewall is stateless and the attribute is not already setStatelessAuthenticatorFactoryInterface for authenticators targeting stateless firewalls only and that don’t require a user providerSecurity::login() return the authenticator responsesecurity.firewalls.logout.csrf_token_generator config option, use security.firewalls.logout.csrf_token_manager insteadTokenHandlerFactoryInterface, OidcUserInfoTokenHandlerFactory, OidcTokenHandlerFactory and ServiceTokenHandlerFactory for AccessTokenFactorySecurity helper classSymfony\Component\Security\Core\Security service alias, use Symfony\Bundle\SecurityBundle\Security insteadSecurity::getFirewallConfig() to help to get the firewall configuration associated to the RequestSecurity::login() to login programmaticallySecurity::logout() to logout programmaticallysecurity.firewalls.logout.enable_csrf to enable CSRF protection using the default CSRF token generatorsecurity.firewalls.switch_user.target_route option to configure redirect target route on switch usersecurity.enable_authenticator_manager config optionsecurity.access_control now accepts a RequestMatcherInterface under the request_matcher option as scope configurationsecurity.access_control now accepts an attributes array to match request attributes in the RequestMatchersecurity.access_control now accepts a route option to match request route in the RequestMatchersecurity.authorization_checker and security.token_storage services are now privateUserPasswordEncoderCommand class and the corresponding user:encode-password command,
use UserPasswordHashCommand and user:hash-password insteadsecurity.encoder_factory.generic service, the security.encoder_factory and Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface aliases,
use security.password_hasher_factory and Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactoryInterface insteadsecurity.user_password_encoder.generic service, the security.password_encoder and the Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface aliases,
use security.user_password_hasher, security.password_hasher and Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface insteadlogout.success_handler and logout.handlers config options, register a listener on the LogoutEvent event insteadFirewallConfig::getListeners(), use FirewallConfig::getAuthenticators() insteadFirewallConfig::getListeners(), use FirewallConfig::getAuthenticators() insteadsecurity.authentication.basic_entry_point and security.authentication.retry_entry_point services, the logic is moved into the
HttpBasicAuthenticator and ChannelListener respectivelyFirewallConfig::allowsAnonymous() and the allows_anonymous from the data collector data, there will be no anonymous concept as of version 6.$authenticatorManagerEnabled to true in SecurityDataCollector and DebugFirewallCommandSecurityFactoryInterface and SecurityExtension::addSecurityListenerFactory() in favor of
AuthenticatorFactoryInterface and SecurityExtension::addAuthenticatorFactory()AuthenticatorFactoryInterface::getPriority() which replaces SecurityFactoryInterface::getPosition()MainConfiguration, pass a sorted flat array of
factories instead.always_authenticate_before_granting optionsecurity.access_decision_manager.strategy_service optionrequired_badges firewall config optionlogin_throttling.lock_factory setting defaulting to null (instead of lock.factory)login_throttling.interval (in security.firewalls) option to change the default throttling interval.debug:firewall command.UserPasswordEncoderCommand class and the corresponding user:encode-password command,
use UserPasswordHashCommand and user:hash-password insteadsecurity.encoder_factory.generic service, the security.encoder_factory and Symfony\Component\Security\Core\Encoder\EncoderFactoryInterface aliases,
use security.password_hasher_factory and Symfony\Component\PasswordHasher\Hasher\PasswordHasherFactoryInterface insteadsecurity.user_password_encoder.generic service, the security.password_encoder and the Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface aliases,
use security.user_password_hasher, security.password_hasher and Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface insteadsecurity.authorization_checker and security.token_storage services to privateenable_authenticator_manager config option to true is deprecatedsecurity.authentication.provider.* services, use the new authenticator system insteadsecurity.authentication.listener.* services, use the new authenticator system insteadform_login.form_only optionFirewallListenerFactoryInterface, which can be implemented by security factories to add firewall listenersSortFirewallListenersPass to make the execution order of firewall listeners configurable by
leveraging Symfony\Component\Security\Http\Firewall\FirewallListenerInterfacesecurity.access_controlEntryPointFactoryInterface, authenticators must now implement AuthenticationEntryPointInterface if
they require autoregistration of a Security entry point.AnonymousFactory, FormLoginFactory, FormLoginLdapFactory, GuardAuthenticationFactory, HttpBasicFactory, HttpBasicLdapFactory, JsonLoginFactory, JsonLoginLdapFactory, RememberMeFactory, RemoteUserFactory and X509Factory as @internalAbstractFactory#createEntryPoint() to AbstractFactory#createDefaultEntryPoint()switch_user.stateless firewall option has been removed.argon2i or bcrypt as algorithm, use auto insteadsimple_form and simple_preauth authentication listeners have been removed,
use Guard instead.SimpleFormFactory and SimplePreAuthenticationFactory classes have been removed,
use Guard instead.LogoutUrlHelper and SecurityHelper templating helpers, use Twig insteadlogout_on_user_change firewall optionthreads encoder optionsecurity.authentication.trust_resolver.anonymous_class parametersecurity.authentication.trust_resolver.rememberme_class parametersecurity.user.provider.in_memory.user service.anonymous: lazy mode to firewalls to make them (not) start the session as late as possiblemigrate_from option to encoders configuration.argon2id encoder, undeprecated the bcrypt and argon2i ones (using auto is still recommended by default.)SecurityDataCollector class as @final.auto (recommended), native and sodiumlogout.delete_cookies
option is deprecated and will be disabled in Symfony 5.0. This affects to cookies
with dashes in their names. For example, starting from Symfony 5.0, the my-cookie
name will delete my-cookie (with a dash) instead of my_cookie (with an underscore).security.authentication.trust_resolver.anonymous_class and
security.authentication.trust_resolver.rememberme_class parameters to define
the token classes is deprecated. To use custom tokens extend the existing
Symfony\Component\Security\Core\Authentication\Token\AnonymousToken.
or Symfony\Component\Security\Core\Authentication\Token\RememberMeToken.Symfony\Bundle\SecurityBundle\DependencyInjection\Compiler\AddExpressionLanguageProvidersPassjson_login_ldap authentication provider to use LDAP authentication with a REST API.framework.session.cookie_*
and added an “auto” mode to their “secure” config option to make them secure on HTTPS automatically.simple_form and simple_preauth authentication listeners, use Guard instead.SimpleFormFactory and SimplePreAuthenticationFactory classes, use Guard instead.port in access_controlswitch_user.stateless firewall option is deprecated, use the stateless option instead.logout_on_user_change firewall option is deprecated.SecurityUserValueResolver, use
Symfony\Component\Security\Http\Controller\UserValueResolver instead.FirewallContext::getContext()FirewallMap::$container and ::$map privateUserPasswordEncoderCommand::_construct() argument mandatoryUserPasswordEncoderCommand does not extend ContainerAwareCommand anymoreVoterInterfaceacl:set along with SetAclCommand classinit:acl along with InitAclCommand classacl configuration key and related services, use symfony/acl-bundle insteadlogout_on_user_change is now always true, which will trigger a logout if the user changes
between requestsswitch_user.stateless firewall option is true for stateless firewallssecurity.helper service that is an instance of Symfony\Component\Security\Core\Security
and provides shortcuts for common security tasks.security.voter tag without implementing the
VoterInterface on the class is now deprecated and will be removed in 4.0.FirewallContext::getListeners() now returns \Traversable|arraylogout_on_user_change to the firewall options. This config item will
trigger a logout when the user has changed. Should be set to true to avoid
deprecations in the configuration.acl:set along with SetAclCommand classinit:acl along with InitAclCommand classstateless option to the switch_user listenerUserPasswordEncoderCommand without its constructor
arguments fully provided.UserPasswordEncoderCommand::getContainer() and relying on the
ContainerAwareCommand sub class or ContainerAwareInterface implementation for this command.FirewallMap::$map and $container properties.users node for in_memory user provider are no longer normalized.FirewallContext::getListeners()SecurityUserValueResolver to inject the security users in actions via
Symfony\Component\Security\Core\User\UserInterface in the method signature.security.context service.key setting of anonymous, remember_me and http_digest
in favor of the secret setting.intention firewall listener setting in favor of the csrf_token_id.security.context service for the security.token_storage and
security.authorization_checker services.[BC BREAK] The custom factories for the firewall configuration are now registered during the build method of bundles instead of being registered by the end-user (you need to remove the ‘factories’ keys in your security configuration).
[BC BREAK] The Firewall listener is now registered after the Router one. This means that specific Firewall URLs (like /login_check and /logout must now have proper route defined in your routing configuration)
[BC BREAK] refactored the user provider configuration. The configuration changed for the chain provider and the memory provider:
Before:
yaml
security:
providers:
my_chain_provider:
providers: [my_memory_provider, my_doctrine_provider]
my_memory_provider:
users:
toto: { password: foobar, roles: [ROLE_USER] }
foo: { password: bar, roles: [ROLE_USER, ROLE_ADMIN] }
After:
yaml
security:
providers:
my_chain_provider:
chain:
providers: [my_memory_provider, my_doctrine_provider]
my_memory_provider:
memory:
users:
toto: { password: foobar, roles: [ROLE_USER] }
foo: { password: bar, roles: [ROLE_USER, ROLE_ADMIN] }
[BC BREAK] Method equals was removed from UserInterface to its own new
EquatableInterface. The user class can now implement this interface to override
the default implementation of users equality test.
added a validator for the user password
added new events: security.authentication.success and security.authentication.failure
fired on authentication success/failure, regardless of authentication method,
events are defined in new event class: Symfony\Component\Security\Core\AuthenticationEvents.
Added optional CSRF protection to LogoutListener:
yaml
security:
firewalls:
default:
logout:
path: /logout_path
target: /
csrf_parameter: _csrf_token # Optional (defaults to "_csrf_token")
csrf_provider: security.csrf.token_generator # Required to enable protection
intention: logout # Optional (defaults to "logout")
If the LogoutListener has CSRF protection enabled but cannot validate a token, then a LogoutException will be thrown.
Added logout_url templating helper and Twig extension, which may be used to
generate logout URL’s within templates. The security firewall’s config key
must be specified. If a firewall’s logout listener has CSRF protection
enabled, a token will be automatically added to the generated URL.